En bref
- CVE-2019-14825 est une vulnérabilité FAIBLE (CVSS 2.7) touchant katello, katello (theforeman).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.65%, plus élevée que 51.3% des vulnérabilités.
- Correctif : mettre à jour vers 3.12.2, 3.12.0.9 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| katello RubyGems | ≥ 3.0.0.0, < 3.12.2
| 3.12.2
|
| katello | ≥ 3.0.0.0, < 3.12.0.9
| 3.12.0.9
|
Description
A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.2. Registry credentials used during container image discovery were inadvertently logged without being masked. This flaw could expose the registry credentials to other privileged users.
NVD description
A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9. Registry credentials used during container image discovery were inadvertently logged without being masked. This flaw could expose the registry credentials to other privileged users.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free